TA570

TA570 is a Proofpoint-tracked cybercrime threat actor and one of the most active Qbot/QakBot malware affiliates. The actor has been tracked since 2018 and is routinely associated with distributing Qbot via phishing campaigns, including thread hijacking of existing email conversations, malicious attachments, and URLs. TA570 has also used compromised WordPress sites and file-hosting sites to host payloads. The content links TA570 to Qbot/QakBot delivery in campaigns that used Microsoft Office documents and, in 2022, exploitation of CVE-2022-30190 (Follina / MSDT) to infect victims. Reported delivery chains included HTML attachments that reconstructed ZIP archives, disk images containing LNK shortcuts and hidden DLLs, and Word documents that attempted to invoke ms-msdt to download and execute Qbot. TA570 was also observed using more traditional Qbot execution paths via mounted disk images, LNK files, and rundll32-loaded DLLs. TA570 is described as an initial access facilitator / malware distributor in the cybercrime ecosystem. Qbot activity associated with TA570 has been observed preceding follow-on ransomware activity, and the content states Qbot used by TA570 has been observed delivering ransomware including ProLock and Egregor. More broadly, the content places TA570 among groups that enable later-stage intrusions involving tools such as Cobalt Strike and ransomware deployment. A distinctive TA570 characteristic noted in the content is the use of U.S. presidents' names in malware configuration or campaign identifiers, leading to the nickname "presidents" affiliate; examples include identifiers such as obama186, obama187, and obama225. Known alias in the provided content: ta570.